Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f8e4c1bd06e1da3…

MALICIOUS

PDF

83.8 KB Created: 2021-03-15 19:32:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9fd50fdbe5626fe6b2e94310d2584836 SHA-1: a40a83b74d0ae52ce20a8dee24a761a0ef757657 SHA-256: 6f8e4c1bd06e1da34268a61c635c08cd0a1812528ebcfad96d90d5b9a220734d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, a common tactic for phishing or malware distribution. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, and the primary malicious URL identified is 'https://zajinet.ru/strik?utm_term=can+you+ship+usps+first+class+from+home'. While no scripts were explicitly extracted, the presence of embedded URLs and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=can+you+ship+usps+first+class+from+home
    • https://cdn.sqhk.co/wixexozesila/oShgib5/42520752404.pdf
    • http://tarigutese.mygamesonline.org/13311369512.pdf
    • https://fagisidide.weebly.com/uploads/1/3/2/6/132682833/sisuman_tutaxi_woxej.pdf
    • https://zonerizarom.weebly.com/uploads/1/3/4/3/134310007/600e4e865b.pdf
    • https://cdn.sqhk.co/xojafimib/mHNOjjn/irunner_app_support.pdf
    • http://kotudekudoges.getenjoyment.net/accidentes_de_transito_en_costa_rica.pdf
    • https://gaxifuxizuru.weebly.com/uploads/1/3/0/7/130739475/tazopaxodon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f867c6cd-7aae-4938-a634-6821dcb48262.filesusr.com/ugd/eb45fa_a4d262c74271484597ace2382c125256.pdf?index=true
    • https://69c5641f-197a-42c1-bef1-daa502c1f1d7.filesusr.com/ugd/948cea_5f717887e07a4c9f9d19b03e5bb8536a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/72e05596-47ee-4257-8a70-713ef3720509/xepag.pdf
    • http://vimixof.onlinewebshop.net/schwinn_recumbent_bike_fix.pdf
    • https://506dbbd1-d4b3-44b1-a4c9-6b5d0cab6a23.filesusr.com/ugd/c75f60_9b1a0b1225f5487eaa151777825da6d7.pdf?index=true
    • https://s3.amazonaws.com/retobifulipo/fusion_gratuit_telecharger.pdf
    • https://uploads.strikinglycdn.com/files/63fc98c1-4b7b-4086-895c-f23a822c9158/everyones_an_author_with_readings_2016_mla_update_free.pdf
    • https://s3.amazonaws.com/nakuzafol/genetic_programming_theory_and_practice.pdf
    • https://29474179-7c7c-44ae-84e0-3c37792f2e25.filesusr.com/ugd/7f817d_90900dce038a4bb8bd5d3384efa96613.pdf?index=true
    • https://s3.amazonaws.com/suxugipipolazog/list_of_asean_countries.pdf
    • https://s3.amazonaws.com/lososimap/html_bold_tag_android.pdf
    • https://uploads.strikinglycdn.com/files/727606fc-c641-4073-9725-210773b8ac75/pifutiwutof.pdf
    • https://b2d1eea7-aef5-47fc-962c-88b5513ecafc.filesusr.com/ugd/3a57bc_49b050ba6c01430d800923d1b1b20f27.pdf?index=true
    • https://uploads.strikinglycdn.com/files/795c9ada-ff8c-4f4f-a9fd-bcfbaaa39d5d/sole_f80_treadmill_best_price.pdf
    • https://s3.amazonaws.com/vibuvomomuv/74541940433.pdf
    • https://uploads.strikinglycdn.com/files/8c236381-e019-46f4-b5a7-da85247a52ce/labox.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a45.bin
3d7dce76bc1073cf8dce0d6e8de6c2cf6f680550a94f480bfe2e23437afb6a4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A45 5260 bytes
font_01_sfnt_off00011c08.bin
943345271eac7a16aa6129c23077733bab995de109f015a395467c9679fb1b0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C08 11068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.